diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 384ae89..0ff1b94 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -65,10 +65,12 @@ svalinn (TLS) → lith-http (Elixir :4000) → BEAM NIFs → core-zig (C ABI) 
 - **Elixir** — OTP control plane, HTTP API
 - **Rust** — BEAM NIF (Rustler), studio backend
 - **ReScript** — Client libraries (if needed)
+- **Bun** — JavaScript runtime and package management
 - **Nickel** — Configuration
 
 ### BANNED
 - TypeScript, Python, Go, Java, Node.js, npm
+- Deno (use Bun)
 
 ## Build Commands
 
diff --git a/README.adoc b/README.adoc
index c6ac258..ff77a89 100644
--- a/README.adoc
+++ b/README.adoc
@@ -142,7 +142,7 @@ Lithoglyph is structured in layers, each with a specific language and responsibi
 
 == Core Invariants
 
-These are *non-negotiable* guarantees:
+These are *non-negotiable* intended requirements (_status: enforcement incomplete; reversibility theorem intended_):
 
 [horizontal]
 Truth Ownership:: On-disk truth is owned by the block/journal layer; higher layers do not bypass it.
diff --git a/docs/API-REFERENCE.adoc b/docs/API-REFERENCE.adoc
index 994208f..64c0999 100644
--- a/docs/API-REFERENCE.adoc
+++ b/docs/API-REFERENCE.adoc
@@ -1204,7 +1204,7 @@ https://lith.example.com/v1
 [source,bash]
 ----
 # API Key (header)
-curl -H "X-Lith-API-Key: lith_sk_live_abc123" \
+curl -H "X-Lith-API-Key: ${LITH_API_KEY:?set your API key}" \
   https://lith.example.com/v1/query
 
 # JWT Bearer token
diff --git a/docs/SECURITY-AUTH.adoc b/docs/SECURITY-AUTH.adoc
index 8ad3e3a..dcde188 100644
--- a/docs/SECURITY-AUTH.adoc
+++ b/docs/SECURITY-AUTH.adoc
@@ -238,27 +238,29 @@ lith auth create-key \
   --expires "2025-12-31"
 
 # Output:
-# API Key: lith_sk_live_abc123...xyz789
-# Key ID: key_01234567
+# API Key: <generated-api-key>
+# Key ID: <generated-key-id>
 # WARNING: This key will only be shown once. Store it securely.
 
 # List keys (shows metadata only, not secrets)
 lith auth list-keys
 
 # Revoke a key
-lith auth revoke-key key_01234567 --reason "Rotation"
+lith auth revoke-key "${LITH_KEY_ID:?set the key ID to revoke}" --reason "Rotation"
 ----
 
 ==== Usage
 
+Supply the generated API key through the `LITH_API_KEY` environment variable.
+
 [source,bash]
 ----
 # HTTP header (preferred)
-curl -H "X-Lith-API-Key: lith_sk_live_abc123...xyz789" \
+curl -H "X-Lith-API-Key: ${LITH_API_KEY:?set your API key}" \
   https://lith.example.com/v1/query
 
 # In GQL session
-lith shell --api-key "lith_sk_live_abc123...xyz789"
+lith shell --api-key "${LITH_API_KEY:?set your API key}"
 ----
 
 ==== Key Scopes